CVE-2025-1562 — AI Deep Analysis Summary

🚨 **Essence**: Unauthenticated Arbitrary Plugin Installation. 💥 **Consequences**: Attackers can install malicious plugins (webshells), leading to full site compromise, data theft, and server takeover.…

🛡️ **CWE-862**: Missing Authorization. 🔍 **Flaw**: The `install_or_activate_addon_plugins()` function lacks a capability check. 🗝️ **Weakness**: The nonce hash is weak, allowing bypass of authentication checks.

📦 **Product**: FunnelKit Automations (Recover WooCommerce Cart Abandonment...). 👤 **Vendor**: amans2k. 📅 **Affected**: Versions **3.5.3 and earlier**. 🌐 **Platform**: WordPress & WooCommerce.

👑 **Privileges**: Unauthenticated access (No login needed). 📂 **Data**: Full control over the WordPress installation. 🕸️ **Action**: Install arbitrary PHP plugins/webshells.…

📉 **Threshold**: **LOW**. 🚫 **Auth**: No authentication required. ⚙️ **Config**: Exploitable via REST API endpoint.…

🔓 **Public Exp?**: **YES**. 📂 **PoC**: Available on GitHub (gmh5225). 🤖 **Scanner**: Nuclei templates available (projectdiscovery). 📝 **Method**: POST request to REST API with malicious ZIP URL.

🔍 **Check**: Scan for REST endpoint `/autonami-app/plugin/install_and_activate`. 📊 **Tool**: Use Nuclei with CVE-2025-1562 template. 📦 **Verify**: Check plugin version in WordPress admin (if accessible) or HTTP headers.

🛡️ **Fixed?**: **YES**. 📅 **Patch Date**: June 18, 2025. 🔄 **Update**: Upgrade to version **> 3.5.3**. 📖 **Ref**: WordPress Trac changeset 3305437 addresses the API loader and admin class.

🚧 **Workaround**: If unpatched, **disable the plugin** immediately. 🚫 **Block**: Restrict access to `/wp-json/autonami-app/` via WAF. 🔒 **Hardening**: Disable REST API for non-authenticated users if possible.

🔥 **Urgency**: **CRITICAL**. 🚨 **Priority**: **P0**. ⚡ **Reason**: Unauthenticated RCE potential via plugin install. 🏃 **Action**: Patch immediately or disable plugin to prevent total site takeover.